Personal alarms and GPS trackers give families peace of mind. An elderly parent living alone can press an SOS button to call for help, some devices detect falls automatically, and parents use similar trackers for children. But many of these low-cost devices have weak security, and in some cases spying on them is as simple as sending a text message.
How these devices work
Most personal alarms and GPS trackers contain a SIM card, a GPS receiver, a microphone and a speaker. The owner registers a phone number with the device. When the wearer presses the SOS button, or the device detects a fall, it calls that number and sends its location by SMS or mobile data.
Many of these products are made by a small number of manufacturers and sold worldwide under different brand names. That means a single weakness can affect thousands of devices sold by different companies.
The security problem
Researchers at Fidus Information Security in the UK examined popular personal alarm and tracker models and found serious weaknesses:
- SMS commands with a default PIN. The devices could be configured by text message, protected only by a default PIN that most owners never change.
- Location tracking. Anyone who knew the device’s phone number could send a command to make it report its GPS location.
- Silent listening. The device could be told to call a number and switch on its microphone, letting an attacker listen in.
- Disabling the device. A crafted SMS could change settings or disable the mobile connection, so the alarm would fail when it was needed.
For a device meant to protect vulnerable people, these are serious risks: they expose the wearer’s location and conversations, and can stop the alarm working in an emergency.
How to choose and set up a safer device
- Change the default PIN or password immediately, if the device allows it.
- Restrict SMS commands to authorised phone numbers only, if the setting exists.
- Keep the device’s phone number private. Treat it like a password.
- Buy from vendors that publish security information and provide firmware updates.
- Check reviews and news for known vulnerabilities in the model before buying.
- Test it regularly to make sure alerts and calls still reach the right people.
Lessons for manufacturers
Security has to be designed in from the start. Unique per-device credentials, authenticated configuration, encrypted communication and a way to update firmware are far easier to build in than to retrofit once thousands of devices are already in the field. If you build connected devices or the apps and APIs behind them, independent mobile and API penetration testing can find these issues before launch. Get in touch to discuss your product.
